JP5799173B2 - Executing secure communication in the support system - Google Patents

Description

  Properly configuring secure communications can be difficult in many situations. For example, secure communication protocols (eg, secure socket layer (SSL) and transport layer security (LLS) protocols) can be configured in the operating system. In order to configure the protocol within the operating system, it is necessary to configure a key pair that forms the basis for certification and / or secure communication from the certificate authority. Not only is it difficult to configure such an operating system, but each protocol execution, operating system and / or application may have different configuration requirements (eg, cryptographic functions) for access to secure communications. Not only are different configuration requests difficult to implement, but the risk of proof and / or private key loss due to server failure by an intruder if the operating system or application is not properly hardened Occurs. If a private key loss occurs, the key may be used by an intruder, thus losing reliability in the benefits of secure communication encryption.

  Attempts to remove cryptographic loads from the operating system configuration have resulted in several application programming interfaces. For example, public key cryptography standard PKCS # 11 is used in a virtual machine to expose cryptographic primitives without exposing the key itself to the guest operating system. However, this solution can be difficult to configure because the requirements for using PKCS # 11 vary from software to software. Although various technologies are used to effectively simplify the use of secure communications, there are variations in the success of the technologies used due to task complexity.

6 illustrates an example secure communication message flow for a guest operating system in accordance with at least one embodiment. 7 illustrates an example of a process that can be used to enable secure communications in a virtualized environment, according to at least one embodiment. 6 illustrates an example of a process that can be used in receiving secure communications in a virtualized environment, according to at least one embodiment. 6 illustrates an example of a process that can be used in transmitting secure communications in a virtualized environment, according to at least one embodiment. 6 illustrates an example of a process that can be used in creating a virtual machine for secure communication, according to at least one embodiment. 6 illustrates an example of a web page that can be used in configuring secure communications in accordance with at least one embodiment. 6 illustrates an example of the transfer and use of authentication information by a support system within a service provider, according to at least one embodiment. Fig. 4 illustrates an environment in which various embodiments can be implemented.

  In the following description, various embodiments will be described. For purposes of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the embodiments. However, it will be apparent to those skilled in the art that these embodiments may be practiced without the specific details. Furthermore, well-known features may be omitted or simplified in order not to obscure the description of the embodiments.

The techniques described and proposed herein include systems and methods for performing secure communications in a support system that is an alternative to a guest operating system. For example, a support system (eg, hypervisor) in a virtualized environment can negotiate, encrypt, and decrypt communications on behalf of a guest operating system of one or more guest operating systems on a host. . At the top of the normal management duties of one or more guest operating systems, the hypervisor may also process messages between the destination computing system and the guest operating system. The hypervisor may create and maintain a secure communication channel with the destination computing system using authentication information that identifies the guest operating system. While the secure communication channel is open, the hypervisor may save the associated key, secret and other state information for each secure communication session. By examining the path settings for each incoming or outgoing communication, the hypervisor can match the states that can be used for communication processing (eg, encryption or decryption of communication). Message processing by the hypervisor can make secure communication transparent to the guest operating system. For example, the guest operating system may send a decryption message through the virtual driver that is obtained by the hypervisor and encrypted before leaving the host. By providing secure communication, the hypervisor can protect guest operating system secrets from guest operating system failures and reduce the guest operating system configuration load. Secure communications can also benefit from message integrity, authenticity and / or confidentiality.

  In the example environment 100 shown in FIG. 1, performing secure communications within a support system may be performed in accordance with at least one embodiment. The hypervisor 102 on the physical machine 104 can serve the guest operating system 106. Guest operating system 106 may send messages to and receive messages from other computing devices (eg, laptop 108, desktop 110, and mobile device 112 (eg, cell phones)). For example, FIGS. 2-4 illustrate examples of processes that can be used to send and / or receive secure messages. The hypervisor 102 can negotiate secure connections with the computing devices 108, 110 and 112 and store state information 114 associated with each secure connection. A clear text message 120 (or a message encrypted by a higher level application executing within the guest operating system 106) may be sent by the guest operating system 106 and obtained by the hypervisor 102. The hypervisor 102 may create the secure message 122 from the clear text message 120 using the state information 114 associated with the guest operating system 106 and the destination computing device. Thereafter, secure message 122 may be sent to destination computing devices 108, 110 and 112.

  Incoming secure messages can also be processed by the hypervisor. The incoming secure message 122 can be examined by the hypervisor to determine the destination guest operating system and the source computing devices 108, 110, and 112. Using the determined destination and source, the hypervisor 102 may then use the associated state information 114 to create a clear text message 120 and / or check the integrity of the secure message 122. A clear text message 120 can then be sent to the guest operating system 106.

Although the hypervisor 102 has been described as an example of a support system for a guest operating system, other configurations are possible (eg, other hardware and / or software implementations). The hypervisor can be viewed as a virtualization support system for the guest operating system (eg, Dom0 in the Xen® system, the parent partition in the Hyper-V system, and the service provided by the virtualization system). In one embodiment, a security component (eg, a cryptographic processor or a hardware security module (HSM)) can be used. Depending on whether multiple guest operating systems 106 are supported by the HSM, the hypervisor may facilitate communication with the HSM and the guest operating system. For example, the hypervisor 102 may route secure messages to the HSM along with the guest operating system destination. A clear text message received from the HSM can then be received by the hypervisor 102 and routed to the guest operating system 106. In another embodiment, the support system can be a virtualization driver. A virtualization driver can benefit from a secure connection through the use of hash message authentication code (HMAC) and encryption (eg, message integrity, authenticity and confidentiality). For example, use of a virtualization driver by a guest operating system may indicate the use of a secure connection. The driver may sign HMAC and encrypted outgoing messages. The HMAC can prove message integrity and authority. This is because only the owner of the private key can sign the message, and the integrity of the message is also confirmed by the signature through the hash function. Once encrypted, it can be assumed that the confidentiality of the message is reasonably preserved. In another embodiment, the support system (s) enables secure communication for a guest system (eg, a computer system with an operating system running directly on the computer system hardware). For example, the support system may be a computing resource and receives a message on behalf of a guest system that may be another computing resource. The computing system receives clear text messages from the guest system and processes these messages for transmission by a secure protocol. Process the received message and send it as clear text to the destination guest system. One advantage is that the guest system can be protected from the authentication information being accessed. For example, the guest system cannot directly access the authentication information unless the user selects a setting that allows access to the authentication information. In some embodiments, only service providers can access authentication information and guest systems cannot.

  Since clear text messages do not leave a trust boundary, it may be necessary to consider whether the message is secure in at least some situations. A trust boundary can be defined by a system in which all subsystems are reliable. Since clear text messages are created at physical machine boundaries or via a reliable connection to the HSM, clear text messages do not leave a boundary of a trusted computing device (eg, a network device). There is a case. If the guest operating system is considered less secure than the support system (eg, if the application or system is always deployed), the secret may actually be considered more secure in the support system. For example, if an application has a vulnerability, an intruder may use this vulnerability to break into the guest operating system. However, since the private information is stored in the hypervisor, the intruder cannot access the private information (for example, a secret key). This is because private information cannot be accessed from the guest operating system. In some embodiments, only the user can access the guest operating system. This is because hypervisors and other computing resources may be managed by entities. If the entity has more experience than the user in the enhanced system, the user may wish to have the entity manage private information and secure connections.

  Several advantages may be realized when the responsibility for secure communication is transferred from the guest operating system to the support system (eg, hypervisor). For example, the dependence of secure communication on the operating system can be eliminated. Executing secure communication with a hypervisor allows various versions and brands of guest operating systems to use secure communication. The version of the secure communication protocol can be updated in the hypervisor, reducing the impact on the guest operating system. The guest operating system can be updated with little to no increase in complexity or inconsistency in secure communication configuration. Automation in the support system can make automation more practical. Since the hypervisor configuration is similar on multiple hosts, automation need only target the hypervisor even if the differences between guest operating systems are not the same. Automatic configuration of secure communications (eg, SSL and / or TLS) is desirable. Because of this automatic configuration, the server administrator does not have to learn the manual configuration of the server himself. SSL / TLS enablement and / or certification and other secret recycling via application programming interface (API) automation may also be enabled by automation. Automation can make secure communications more transparent to developers with minimal configuration. This is because messages sent in clear text are secured by the support system (not the guest operating system). For example, the developer need only instruct the application to communicate using a communication channel (eg, driver, adapter, IP address or port visible on the guest operating system) to request secure communication. A support system (eg, hypervisor) can receive messages through the channel and perform secure communication on the guest operating system with the destination device specified by the application. Other benefits of moving secure communications capabilities to the support layer include, but are not limited to, the ability to update protocols on the fly without the need for any application-specific reconfiguration or modification (cryptographic agility), operating system or application There is a point that any hardware crypto acceleration can be leveraged in a standard way without the need for specific support.

In one embodiment, a hypervisor on the host machine as shown in FIG. 1 may secure communication through a secure communication process 200 instead of a guest operating system. Some or all of process 200 (or any other process described herein or variations and / or combinations thereof) may be performed under the control of one or more computer systems. The one or more computer systems are composed of executable instructions, and execute code collectively on one or more processors, collectively executed by hardware, or a combination thereof. (E.g., executable instructions, one or more computer programs, or one or more applications). The code can be stored on a computer readable storage medium (eg, in the form of a computer program that includes a plurality of instructions that can be executed by one or more processors). A computer readable storage medium may be non-transitory.

The hypervisor may receive incoming message 201. If the message requires further security processing (202), the hypervisor may receive the request as a request for secure communication with the guest operating system and the external computing system (203). If not, the hypervisor may forward the message unprocessed (222). The hypervisor may negotiate a secure protocol using guest operating system authentication information (eg, IP address, key and / or credential information) instead of the guest operating system (204). Information related to the protocol and its state (eg, exchange key, secret and other state data) may be stored (206) and associated with the guest operating system. The message may then be received by the hypervisor from an external computing system and / or guest operating system (208). As the message arrives (210), the hypervisor may determine a guest operating system destination and an external computing system source (212). Using the destination and source, the hypervisor may decrypt (214) and confirm the incoming message with reference to the state information and guest operating system authentication information. Confirmation can confirm the integrity and authenticity of the message. A clear text message may then be sent to the guest operating system (216). Once the communication is complete (218), the hypervisor may terminate the communication by terminating the communication link to the external computing system and removing the associated state information (220). If not (218), the system may wait for a larger number of messages (208).

  Once the clear text issue message is received from the guest operating system (210), the hypervisor can retrieve the state information using the guest operating system source with the associated destination of the message (224). Using the state information, the hypervisor may encrypt the HMAC clear text issue message and / or sign the HMAC clear text issue message (226). Thereafter, the encrypted outgoing message may be sent to the destination (228). When communication is complete (218), the hypervisor may end the session (220). If not, the hypervisor may wait for the next message (208).

In the process 200 shown in FIG. 2, several advantages can be obtained. New incoming secure communication messages can be transparent to the guest operating system. New incoming communications allow the hypervisor to negotiate with the issuer of the request without having to contact the destination guest operating system. After the hypervisor completes the negotiation, a secure message can be delivered between the issuer and the guest operating system. It is also possible to serve multiple guest operating systems by a single hypervisor having access to authentication information for each guest operating system. Each guest operating system may have its own authentication information (eg, certificate, IP address, key, and other individual information). These authentication information can be broken down into physical hosts controlled by the hypervisor. Because the hypervisor acts as a gateway between the guest operating system and the outside world, the hypervisor can negotiate on behalf of each guest operating system without requiring configuration or knowledge from external systems participating in the negotiation. it can. For example, incoming communications may enter through a hardware interface. The hypervisor may receive communication from the hardware interface and determine that the communication is secure communication. Using the guest operating system credentials, the hypervisor can take on the role of the guest operating system to create and maintain a secure connection. Because the hypervisor is always part of the route to the guest operating system, computing devices with secure connections recognize that the hypervisor is negotiating and securing messages on behalf of the guest operating system Can not.

  Hypervisor configuration may include selecting options for outgoing and incoming secure connections. In one embodiment, the administrator can choose from a number of options for determining communications to be secured (eg, defining all secure connections, secure ports and non-secure ports) Automatic detection of whether messages should be treated as secure, defining secure and non-secure IP addresses, defining secure and non-secure adapters). For example, network traffic on ports 22 and 80 may be treated as non-secure, but traffic on port 443 may be secured. In another embodiment, the guest operating system may have two IP addresses. One of the IP addresses can be used to receive the non-secure message, and the second address can notify the hypervisor to create and maintain a secure connection. The hypervisor may determine whether the communication should be secured with explicit or implicit information. In one embodiment, incoming network traffic may be implicitly defined (eg, by inspection). For example, if the incoming traffic appears to be secured through a protocol (eg, SSL / TLS), the hypervisor may use the determined secure protocol. In another embodiment, incoming network traffic may be explicitly defined (eg, traffic on a specified port or IP address).

Referring to FIG. 3, a process that can be executed by a computer system (eg, physical machine 104 of FIG. 1) is illustrated. In one embodiment, the hypervisor on the host machine may process the secure message received through the receiving process (300). The hypervisor may receive an incoming message (302). If the message is not a secure message (304), and if the message is a secure communication control message (306), the secure communication control process can be followed. An example of a control message may be handshaking or renegotiation. The hypervisor control process may determine a destination guest operating system that uses guest operating system authentication information in the negotiation (308). A sender associated with the state information may be determined (310). Using the determined information, the hypervisor may negotiate (312) with the sender to change or create a secure connection on behalf of the guest operating system. New state information and changed state information can be saved and associated with the guest operating system and the sender (314). In another example, the hypervisor can intercept the request and re-establish a secure connection. Communication can be resumed using the saved state information (eg, session information).

  If the message is a secure message (304), the hypervisor can begin the message receiving process by making a guest operating system destination determination (316) and sender information determination (318). Using the destination and sender information, the hypervisor can retrieve the associated state information. Using the state information, the hypervisor may decrypt (320) and / or confirm the message. The decrypted message may then be sent to the guest operating system (322). If decryption (322) and / or verification fails, the hypervisor may respond to the failure (requesting another message, reporting the failure, terminating the connection and / or renegotiating the connection To do).

  If it is determined that the message is not a secure message (304), and if it is determined that it is not a secure communication control message (306), the message can be treated as a non-secure message (324). Depending on user settings, non-secure messages can be allowed or disallowed. In some embodiments, all non-secure messages can be rejected. In other embodiments, non-secure messages can be granted to the non-secure message handling process. For example, the hypervisor can determine that all messages for a defined port on the guest operating system can be secured and other defined ports can receive non-secure messages. In one embodiment, by coordinating rules with the firewall, non-secure message routes can be blocked outside the trusted network, and secured messages can pass through the firewall.

Referring now to FIG. 4, FIG. 4 illustrates a process that can be performed by a computer system (eg, physical machine 104 of FIG. 1). As shown in FIG. 4, the hypervisor on the host machine may use a secure transmission process (eg, transmission process 400) when receiving a message from the guest operating system. The hypervisor may receive an outgoing message from the guest operating system (402). If the message is not part of the current secure connection (406) and requires a secure connection (408), a secure connection can be negotiated. For example, it may be necessary to establish or renegotiate a secure connection. Using the guest operating system credentials, the hypervisor can negotiate a secure connection on behalf of the guest operating system (410). The state of the connection may be saved (412) as associated with the guest operating system and recipient of the secure connection. If the secure connection was created after operation (412) or has a current connection (406), the received message can be encrypted (414) using the state information. The encrypted message can then be sent to the recipient (416). In some embodiments, non-secure messages may be allowed, have no current secure connection (406), and no secure connection is required (408). Non-secure messages may be processed in this manner according to user settings (418). In one embodiment, all communications need to be secure. Any non-secure communication may drop and / or generate an error.

  The hypervisor may decide to secure the transmission of the message. The hypervisor may explicitly or implicitly determine the need for secure communication. For example, if a connection is currently open to a destination computing system, communication with the destination is implicitly estimated as using secure communication. In another example, by examining each incoming message, messages that appear secure or messages that need to be secured can be processed by the hypervisor. In some embodiments, it is assumed that all outgoing communications have been secured. In another embodiment, the guest operating system may request that a new secure communication channel be opened with the destination through an API call. If not, communication can take place over a normal communication channel. In other embodiments, the guest operating system may explicitly select secure communication by using a communication channel (eg, driver, virtual adapter, IP address or port).

Thus, a support system (eg, hypervisor) can secure connections between multiple computing devices and multiple guest operating systems on a host machine. For secure connections, both initial incoming requests and initial outgoing requests can be handled. With the authentication information assigned to the guest operating system, the support system can function on behalf of the guest operating system in creating and maintaining a secure connection. The support system can use the communication channel to determine for each guest operating system what communications should be secured or allowed to pass. In one embodiment, the support system can change the message header (eg, HTTP header) to indicate that the communication was received over a secure connection.

  The hypervisor can reside in a host system in the data plane that can be managed by the control plane. Requests for changes can be received by the control plane and made on computing resources in the data plane. For example, as shown in FIG. 5, a user may request a control surface to enable secure communications on a computing resource. The control surface may receive this request from the user (502). In response, the control surface may generate a key and request and may request to issue a certificate for the computing resource (504). The certification information may be delivered (506) to a computing resource support system (eg, hypervisor) for installation, storage, and use when needed. Secure communication may be enabled using the settings provided by the user (508).

The configuration specified by the user may be received through multiple channels (eg, API calls, applications and websites). An example of a website 600 for configuring secure communications in the support system is shown in FIG. Website 600 can be accessed by web browser 602. The website may include current configuration information (eg, server name 604, current certification information 606, and current secure protocol configuration information 608). An offer 610 to add secure communication in exchange for a value may be provided as a service to the user. The user can select from a plurality of options 612 to configure a secure communication service. In the illustrated embodiment, the user can select a communication to be secured from a plurality of options. These options include: “Always use secure communication”, “Use only specific ports for secure communication”, “Automatically detect secure communication”, “Use specific IP address for secure communication or virtual Ethernet ( Registered trademark) adapter ". If desired, the user may also request notification that the communication has been secured by changing the message (eg, HTTP header). The user may then click on a button to enable secure communication on the selected guest operating system (616). In the illustrated embodiment, secure communication is being set up. A progress indicator 618 may indicate the progress of the autoconfiguration process, which allows the hypervisor to secure communications on behalf of the selected guest operating system.

After the user clicks button 616 to enable secure communication, the control surface may begin the process of setting up secure communication for the selected guest operating system. For example, the control surface may receive a request to set up secure communication for the guest operating system. The control surface may generate a public / private key pair on behalf of the guest operating system. Using the identification information about the guest operating system and the public key, the control surface requests the guest operating system to issue a digital certificate. Thereafter, the control surface may deliver secure communication configuration information (eg, digital certificates, keys and other secure information) to the hypervisor through the trusted network. The hypervisor may store secure configuration information that is used to create secure communications on behalf of the guest operating system. After completion, the hypervisor can notify the control surface that the setting is complete. The control surface may then notify the user that the configuration is complete and secure communication can be enabled. In some embodiments, this process may be performed without requiring further user intervention by clicking button 616. In other embodiments, the user can intervene (eg, import a digital certificate and / or key pair information rather than generating a digital certificate and / or key pair information for the user).

  Service provider 712 can enable secure communications through the enablement of the support system to intercept and secure communications with guest systems 706 and 728. An example of a guest system is a physical computer system that includes an operating system that executes directly on the hardware of the physical computer system. An example of generation and use (700) of service provider authentication information is shown in FIG. The customer may request to enable secure communication on the guest system 706 maintained by the customer through the computing resource 702. The server 704 in the control plane can receive a request to enable secure communication and can generate a request to generate authentication information 710 for the guest system 706. The control surface may manage computing resources within the data surface (eg, guest system 706). Authentication information generator 708 may generate and set authentication information 710. This authentication information generation may include contacting a certification authority to obtain a valid digital certificate. Upon receiving the authentication information 710, the server 704 may send the authentication information to the support system that is responsible for secure communication of the guest system 706. In one embodiment, the support system may be a network device (eg, a security component 718 attached to the network). In the embodiment shown in FIG. 7, a network-attached security component 718 is included in the switch 716, but the network-attached security component 718 may be stand-alone in other embodiments. A security component 718 attached to the network may receive the authentication information 710 and the configuration to secure communications arriving at and originating from the guest system 706. For example, the incoming secure message 720 can be received by the gateway 721 to the service provider 712 and routed to the switch 716 through the internal network 714, thereby providing a secure communication service to the guest system 706. A security component 718 attached to the network may decrypt and / or verify the incoming secure message 720, resulting in a clear text message 722. Thereafter, clear text message 722 may be sent to destination guest system 706. An outgoing message from guest system 706 may be intercepted by a security component 718 attached to the network. The outgoing message is secured (including encryption) and then sent from the gateway 721 through the internal network 714 and passes through the Internet 724 to the destination system.

  In another embodiment shown in FIG. 7, security component 730 may reside in a host computer 728 (eg, an advanced network interface card (NIC) or security coprocessing hardware). The security component 730 can intercept incoming communications to the host computer 728 and decrypt the incoming secure message 720. The decrypted clear text message 722 may be sent to the guest system in the host computer 728, whether virtualized or not. Outgoing clear text communications are also intercepted and secured (including encryption), resulting in secure communications.

Exemplary embodiments of the present disclosure can be described in view of the following description.
1. A computer-implemented method for providing secure communications, comprising: a set of authentication information associated with a guest operating system under control of one or more computer systems configured with executable instructions Receiving by the hypervisor and the hypervisor, which is an alternative to the guest operating system , using a set of authentication information to establish a secure connection with the computing device using a secure protocol, Functioning as a local endpoint for secure connections, receiving one or more outgoing messages from the guest operating system to the computing device by the hypervisor, and the guest operating system Hypervisor is instead of using a secure protocol and a set of authentication information, the method comprising: encrypting one or more issuing messages from the guest operating system to a computing device, one or more issued The message becomes one or more outgoing encrypted messages, the hypervisor sends the outgoing encrypted messages to the computing device using a secure protocol, and one or more from the computing device The incoming encrypted message is received by the hypervisor and decrypted using a secure protocol and a set of authentication information by the hypervisor, which is an alternative to the guest operating system, to provide one from the computing device. More incoming ciphers Includes making the message to one or more incoming decoded messages, and sending one or more incoming decoded messages to the guest operating system, the.
2. In the computer-implemented method of clause 1, negotiating includes storing protocol state information as associated with a guest operating system and a computing device, the protocol state information comprising guest operating system identification information And the protocol state information is used when encrypting one or more outgoing messages and decrypting one or more encrypted incoming messages.
3. In the computer-implemented method of clause 2, decrypting examines one or more encrypted incoming messages to determine the identity of the computing device and guest operating system referenced in the incoming communication. Using the determined identification information of the guest operating system and the computing device to retrieve protocol state information and using the retrieved protocol state information to decrypt one or more encrypted incoming messages Including.
4). In the method performed by the computer of clause 2, encryption is to receive one or more outgoing messages from the guest operating system, the guest operating system having identification information, and one or more outgoing Examining the message to determine the identity of the computing device referenced in the one or more outgoing messages; using the guest operating system and the computing device identity to retrieve protocol state information; Encrypting one or more outgoing messages using the retrieved protocol state information.
5. In the computer-implemented method of clause 1, decrypting is to route one or more incoming decryption messages to the guest operating system, where the guest operating system is managed by the hypervisor. Included in a set of two or more guest operating systems.
6). In the computer-implemented method of clause 1, decrypting verifies the integrity and authenticity of one or more incoming encrypted messages and then sends the one or more incoming decrypted messages to the guest operating system. Including providing.
7). A computer-implemented method for providing secure communication for a guest on a host system for secure connection with a device under control of one or more computer systems configured with executable instructions Receiving a request to the operating system by a support system of the host system, the host system having a support system and configured to host at least one guest operating system; der that the receiving by a set of authentication information support system associated, the support system using a set of authentication information instead of the guest operating system to establish a secure connection to the device and The support system acts as a secure connection endpoint on behalf of the guest operating system, and the support system sends one or more communications between the guest operating system and the device over the secure connection And the support system includes processing one or more communications to enable a secure connection.
8). The computer-implemented method of clause 7, wherein the method receives a request for a second secure connection with a second device for a second guest operating system on the host system by a support system of the host system. A second set of authentication information associated with the second guest operating system is retrieved by the support system, and the support system uses the second set of authentication information instead of the second guest operating system. Establishing a second secure connection with the second device, wherein the support system functions as an endpoint for the second secure connection on behalf of the second guest operating system; Second secure connection from support system Further comprising a second guest operating system via and transmitting the one or more second communication between the second device.
9. In the computer-implemented method of clause 7, using a set of authentication information means that the support system stores a set of authentication information instead of the guest operating system , and the set of authentication information is: It is further readable by the guest operating system.
10. In the computer-implemented method of clause 7, the support system is a hypervisor.
11. In the computer-implemented method of clause 7, sending the one or more communications further includes encrypting the one or more communications using a secure protocol.
12 In the computer-implemented method of clause 11, the secure protocol is transport layer security.
13. In the computer-implemented method of clause 7, the support system is a hardware security module.
14 In the computer-implemented method of clause 7, the support system is a separate processor in the host system.
15. In the method implemented on the computer of clause 7, the support system encrypts at least a portion of the communication via a secure connection.
16. A computer system for enabling a secure connection, the memory including one or more processors and instructions executable by the one or more processors, wherein the computer system performs at least the following: A support system having a set of guest systems receives secure communication directed from the set of guest systems to the guest system, and the support system receives a guest from the set of guest systems to which secure communication is directed. Selecting a system and providing the decryption message to the selected guest operating system using a set of authentication information indicating identification information of the selected guest operating system, wherein the decryption message Is created from secure communication Authentication information is not available for the selected guest system, it.
17. In the system of clause 16, the system further includes a hardware security module, the hardware security module communicates with one or more processors, and the hardware security module includes one or more encryption services and decryption services. Providing to at least one of the processors, the hardware security module is accessible to the support system for message decoding.
18. In the system of clause 16, the support system is a hardware security module.
19. In the system of clause 16, the support system is a network device, and the support system is disposed between one or more guest systems and a network from which secure communication is received.
20. In the system of clause 17, providing the decrypted message further includes sending a secure communication to the hardware security module and receiving the decrypted message from the hardware security module.
21. In the system of clause 16, providing the decryption message is to receive secure communication through the first communication channel, and upon receipt through the first channel, the support system decrypts and supports secure communication. The system is configured to decode communications received over the first channel, and sends one or more communications received over the second communications channel to the guest system; The support system is further configured to pass communications received through the second channel.
22. In the system of clause 16, providing the decryption message further includes modifying the decryption message to indicate that the decryption message was previously encrypted.
23. In the system of clause 16, the set of authentication information includes a secret key assigned to the guest operating system.
24. One or more computer-readable storage media having executable instructions collectively stored on the storage medium, wherein the instructions are executed by one or more processors of the computer system; The computer system does at least the following: the support system receives a request for a secure connection with the device to the guest system, and the support system retrieves a set of authentication information associated with the guest system. Authentication information is protected from access by the guest system, and the support system uses a set of authentication information instead of the guest system to establish a secure connection with the device, Is a secure connection endpoint instead of a guest system. Functions as cement, that a, the support system sends one or more communication between the guest system and device over a secure connection.
25. In the computer readable storage medium of clause 24, the medium further includes instructions, and when the instructions are executed by one or more processors of the computer system, the computer system does at least: a secure connection to the guest system Receiving a request to add a service, where the service uses a support system instead of the guest system to manage a secure connection and generate a set of authentication information for the guest system And the support system stores a set of authentication information.
26. In the computer readable storage medium of clause 25, the medium further includes instructions, and when the instructions are executed by one or more processors of the computer system, the computer system: at least: secure connection service charged Send the user an offer to add to the guest system and receive a fee from the user in exchange for adding the secure connection service. The receipt of the value adds the secure connection service to the guest system. Indicates a request with
27. In the computer readable storage medium of clause 26, the support system is selected from the group consisting of network hardware, a network card, a driver, and a hypervisor.
28. In the computer readable storage medium of clause 24, a request for a secure connection is generated through the use of a communication channel, and the connection through the communication channel is configured to be secured.
29. In the computer readable storage medium of clause 28, the communication channel is selected from the group consisting of a port, a virtual adapter, and a source IP address.
30. In the computer readable storage medium of clause 24, the support system is embedded in a network interface card attached to the guest system.

  FIG. 8 illustrates aspects of an example environment 800 for performing aspects in accordance with various embodiments. As will be appreciated, although a web-based environment is used for illustrative purposes, different environments can be used as appropriate to implement various embodiments. This environment includes an electronic client device 802. The electronic client device 802 may include any suitable device operable to send and receive requests, messages or information over a suitable network 804 and carry the information to a user of the device. Examples of such client devices include personal computers, cell phones, handheld messaging devices, laptop computers, set top boxes, personal data assistants, electronic book readers, and the like. The network may include any suitable network (eg, an intranet, the Internet, a cellular network, a local area network, or any other such network or combination thereof). The components used in such a system may depend at least in part on the type of network and / or environment selected. Protocols and components for communication over such networks are well known and will not be described herein. Communication over the network can be enabled by wired or wireless connections and combinations thereof. In this example, the network includes the Internet. This is because the environment includes a web server 806 that receives a request and provides content in response to the reception. However, it will be apparent to those skilled in the art for other networks that use other devices for similar purposes.

  The exemplary environment includes at least one application server 808 and a data store 810. It is understood that several application servers, layers or other elements, processes or components can be chained or configured to interact to perform tasks (eg, obtaining data from an appropriate data store) Is done. As used herein, the term “data store” refers to any device or combination of devices capable of storing, accessing and retrieving data (eg, in any standard, distributed or clustered environment). Any combination and number of data servers, databases, data storage devices, and data storage media). The application server integrates with the data store as needed to execute one or more application aspects for the client device and any suitable hardware that handles most of the business logic for data access and applications. And may include software. The application server can provide an access control service in coordination with the data store to generate content (eg, text, graphics, audio and / or video to be transferred to the user). This content may be provided to the user by the web server in the form of HTML, XML or another suitable structured language in this example. The handling of all requests and responses and content delivery between client device 802 and application server 808 may be handled by the web server. It will be appreciated that the web server and application server are not required and are merely exemplary components. This is because the structured code described herein can be executed on any suitable device or host machine as described elsewhere herein.

  The data store 810 may include a number of separate data tables, databases or other data storage mechanisms and media that store data related to a particular aspect. For example, the illustrated data store includes a mechanism for storing generated data 812 and user information 816 that can be used to provide content on the generating side. In addition, a state in which the data storage unit includes a mechanism for storing the log data 814 is illustrated. Log data 814 may be used for reporting, analysis or other such purposes. There can be many other aspects that may need to be stored in the data store (e.g., for page image information and for access to the correct information, including the mechanisms listed above. It is understood that any of them can be stored as appropriate or can be stored in a further mechanism in the data store 810). The data store 810 is operable to receive instructions from the application server 808 through logic associated with it and to obtain, update or process data in response thereto. In one example, a user may submit a search request for a particular type of item. In this case, the data storage unit can access the user information to confirm the user identification information, and can access the catalog detailed information to obtain information about the type of item. This information can then be returned to the user (as information in the results listing on the web page that the user can view via the browser on the user device 802). Information about a specific target item may be viewed in a dedicated page or in a browser window.

  Each server typically includes an operating system that provides executable program instructions for general management and operation of the server, and typically stores computer-readable storage media storing instructions. (Eg, hard disk, random access memory, read only memory). When these instructions are executed by the server's processor, the server performs the intended function. Appropriate execution of the operating system and general functions of the server are known or commercially available, and can be easily performed by those skilled in the art, especially in light of the disclosure herein.

  The environment in one embodiment is a distributed computing environment that uses several computer systems and components interconnected using one or more computer networks or direct connections via communication links. However, those skilled in the art will appreciate that such a system can work equally well in systems having fewer or more components as shown in FIG. Accordingly, the description of the system 800 in FIG. 8 should be taken as exemplary in nature and is not intended to limit the scope of the present disclosure.

  Various embodiments can further be implemented in a wide variety of operating environments. These operating environments may include, in some cases, one or more user computers, computing devices or processing devices that can be used to run any of a number of applications. A user or client device may include any of a number of general purpose personal computers (eg, desktop or laptop computers running standard operating systems, as well as running mobile software and supporting a number of networking and messaging protocols) Cellular devices, wireless devices and handheld devices). Such a system may also include a number of workstations running any of a variety of commercially available operating systems and other known applications for purposes such as development and database management. These devices may also include other electronic devices (eg, dummy terminals, thin clients, gaming systems, and other devices capable of communicating over a network).

  In most embodiments, at least one well known to those skilled in the art that supports communication using any of a variety of commercially available protocols (eg, TCP / IP, OSI, FTP, UPnP, NFS, CIFS and AppleTalk). Two networks are used. The network can be, for example, a local area network, a wide area network, a virtual private network, the Internet, an intranet, an extranet, a public switched telephone network, an infrared network, a wireless network, and any combination thereof.

  In embodiments using a web server, the web server may execute any of a variety of servers or mid-tier applications (eg, HTTP server, FTP server, CGI server, data server, Java server, and business application server). ). In response to a request from the user device, the server (s) may be responsive to, for example, any programming language (eg, Java, C, C # or C ++, or any scripting language (eg, Perl)). The program or script can also be executed by executing one or more web applications that can be executed as one or more scripts or programs described in, Python, or TCL, and combinations thereof)). The server (s) may also include a database server (commercially available from Oracle®, Microsoft®, Sybase®, and IBM® to name a non-limiting example). What)

  The environment may include a variety of data stores and other memories and storage media as described above. These may reside in a variety of locations (eg, remote from any or all of the storage media that are local (and / or resident) to one or more of the computers or computers on the network). thing). In a particular set of embodiments, the information may reside in a storage area network (“SAN”) well known to those skilled in the art. Similarly, any necessary files for performing functions attributable to a computer, server or other network device can be stored locally and / or remotely as appropriate. Where the system includes computerized devices, each such device may include hardware elements that are electrically connected via a bus, which may include, for example, at least one central processing unit (CPU). ), At least one input device (eg, mouse, keyboard, controller, touch screen, or keypad), and at least one output device (eg, display device, printer, or speaker). Such systems may also include one or more storage devices (eg, disk drives, optical storage devices and solid state storage devices (eg, random access memory (“RAM”) or read-only memory (“ROM”)), and Removable media devices, memory cards, flash cards).

  Such devices may also include computer readable storage media readers, communication devices (eg, modems, network cards (wireless or wired), infrared communication devices), and working memory as described above. A computer readable storage medium reader may be coupled to a computer readable storage medium or may be configured to receive such a storage medium. The storage medium is a removable storage device and storage for temporarily and / or more permanently storing, storing, transmitting and retrieving remote readable devices, local storage devices, persistent storage devices and / or computer readable information Indicates the medium. Systems and various devices typically also include a number of software applications, modules, services or other elements contained within at least one working memory device (eg, operating system and application programs (eg, client applications or webs). browser)). It will be understood that other embodiments may include numerous variations from the above. For example, customized hardware may be used and / or certain elements may be implemented in hardware, software (eg, portable software (eg, applet)) or both. In addition, connections to other computing devices (eg, network input / output devices) are also available.

  A storage medium containing code or a portion of code and a computer readable medium may include any suitable medium known or utilized in the art (eg, storage medium and communication medium (examples are not limited) In particular, volatile media and non-volatile implemented in any method or technique for storage and / or transmission of information (eg, computer readable instructions, data structures, program modules or other data) Media, removable and non-removable media (eg, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital universal disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic Disk storage or other magnetic storage device, or as desired Any other medium that can be used to store information and that can be accessed by system devices)) based on the disclosure and teachings contained herein, one of ordinary skill in the art will appreciate the various embodiments. It will be appreciated that there are other ways and / or methods for performing.

  The specification and drawings are, accordingly, to be regarded as illustrative rather than as restrictive. However, it will be apparent that various changes and modifications can be made in the present specification and drawings without departing from the broader intent and scope of the various embodiments as described in the claims. is there.

  Other variations are within the intent of the present disclosure. Thus, while the disclosed technology is susceptible to various modifications and alternative constructions, specific exemplary embodiments thereof have been shown in the drawings and have been described above in detail. However, it is not intended that the claims be limited to the specific form (s) disclosed, but on the contrary, the present invention covers all modifications, alternative constructions and appended claims. It is understood to cover equivalent examples that fall within the spirit and scope of the various embodiments as defined therein.

  Where terms such as “a” and “an” and “the” are used in the context of describing the disclosed embodiments (particularly in the context of the following claims), unless otherwise specified herein Or should be construed as covering both singular and plural unless the context contradicts; Terms such as “comprising”, “having”, “including” and “containing” should be interpreted as open-ended terms unless otherwise specified (ie, “including but not limited to”). Should be interpreted as semantic terms). The term “connected” should be construed as being partially or wholly included, attached or joined together, even if there is an interruption in the middle. References to a range of values in this specification are intended to be short methods for individually stating that each distinct value is within the range, unless otherwise specified in the specification. Each distinct value is incorporated herein as if it were individually referenced. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. Where any example and all examples or exemplary phrases (eg, “eg, etc.”) are used herein, they are merely used to more fully illustrate various embodiments; Unless otherwise specified, it is not intended to limit the scope of the claims. No language in the specification should be construed as an element not recited in the claims essential to the practice of the invention.

  Preferred embodiments of this disclosure have been described herein, including the best mode for carrying out the invention by the inventors. Those skilled in the art will appreciate variations from these preferred embodiments upon reading the above description. The inventors expect that those skilled in the art will appropriately use such modifications, and that the inventors perform the invention in a manner different from that specifically described herein. Is intended to be possible. Accordingly, the present invention includes all modifications and equivalents permitted by applicable law with respect to the contents described in the claims. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the invention unless otherwise indicated herein or otherwise clearly contradicted by context.

  All references cited herein (eg, published documents, patent applications, and patents) are hereby incorporated by reference as if each reference had been specifically described throughout the specification. Incorporated by

Claims (15)

A computer-implemented method for providing secure communications, comprising:
Under control of one or more computer systems configured with executable instructions,
A host system support system receiving a request for a secure connection with a device to a guest operating system on the host system, the host system comprising the support system and having at least one guest Being configured to host an operating system;
The support system receives a set of authentication information associated with the guest operating system;
The support system establishes a secure connection with the device using the set of authentication information instead of the guest operating system, wherein the support system replaces the guest operating system with the secure Function as a secure connection endpoint,
The support system sends one or more communications between the guest operating system and the device over the secure connection, wherein the support system processes the one or more communications; Enabling the secure connection. The support system of the host system receiving a request for a second secure connection with a second device for a second guest operating system on the host system;
The support system retrieving a second set of authentication information associated with the second guest operating system;
The support system uses the second set of authentication information instead of the second guest operating system to establish a second secure connection with the second device, A support system serving as an endpoint for the second secure connection in place of the second guest operating system;
The support system further comprises transmitting one or more second communications between the second guest operating system and the second device via the second secure connection. A method executed by the computer according to claim 1. Using the set of authentication information further includes the support system storing the set of authentication information instead of the guest operating system, wherein the set of authentication information is for the guest operating system. The computer-implemented method of claim 1, wherein the method is non-readable.   The support system is a hypervisor and is a hardware security module attached to the host system, embedded in a network interface card attached to the host system, or a separate processor in the host system The computer-implemented method of claim 1, wherein   The computer-implemented method of claim 1, wherein sending one or more communications further comprises encrypting the one or more communications using a secure protocol.   The computer-implemented method of claim 5, wherein the secure protocol is transport layer security. And to receive a request for the case additional secure connection service to the guest operating system on the host system, instead of the guest operating system, manages the secure connection using the support system,
Requesting a set of authentication information associated with the guest operating system;
The computer-implemented method of claim 1, further comprising the support system storing the set of authentication information. The computer-implemented method of claim 7, further comprising charging a fee for adding the secure connection service to the guest operating system.   The computer-implemented method of claim 1, wherein the support system encrypts at least a portion of the communication over the secure connection. A computer system for enabling a secure connection comprising:
One or more processors;
A memory containing instructions executable by the one or more processors, the instructions causing the computer system to
A support system having a set of guest systems receives secure communications directed to a guest system in the set of guest systems;
And said support system, the said one guest system secure communication is directed to the set of guest systems or al selection,
The method comprising the host system provides a decoded message by using a set of authentication information indicating identification information of the selected guest tosylate stem to the selected guest tosylate stem, the decoded message is said secure Created from communication, wherein the authentication information at least does not be available to the selected guest system;
system.   And further comprising a hardware security module, wherein the hardware security module communicates with the one or more processors, and wherein the hardware security module provides an encryption service and a decryption service at least one of the one or more processors. 11. The system of claim 10, wherein the hardware security module is accessible to the support system for decoding the message.   The system according to claim 10, wherein the support system is a network device, and the support system is arranged between the one or more guest systems and a network from which the secure communication is received. Providing a decrypted message
Receiving the secure communication through a first communication channel, wherein the support system decrypts the secure communication upon reception through the first channel, and the support system receives through the first channel. Configured to decrypt the transmitted communication;
Sending one or more communications received over a second channel to the one guest system, wherein the support system is configured to send communications received over a second channel; The system of claim 10, further comprising: Before providing the decoded message, further comprising prior Symbol decoded messages to change the header of the decoded message to indicate that it has been received through the secure connection, the system of claim 10. Said set of authentication information comprises a secret key assigned to the guest Toshi stem system of claim 10.

Images